ZincFive’s Privacy Policy Statement

We are pleased that you are interested in our organization. The protection of your Personal Data is particularly important to our management. As a rule, you can use our websites without disclosing any Personal Data to us. However, if you wish to use more specific services via our websites, including our other websites, applications and social media pages, we may have to process your Personal Data. If we wish to process data about you and we cannot rely on any other legal basis, we will always ask you for your Consent first (e.g., via a cookie banner).

We always comply with applicable data protection laws when handling your Personal Data (such as name, address, email or telephone number). With this Privacy Policy, we inform you about which data we process. This Privacy Policy also explains to you what rights you have as a Data Subject.

We have taken various technical and organizational measures to protect your data on our websites in the best possible way. Nevertheless, there are always risks on the internet and complete protection is not possible. For this reason, you can also transmit your Personal Data to us by other means, for example by telephone, if you prefer.

This Privacy Policy is not only intended to fulfill the obligations under GDPR and to comply with the law of the Member States of the European Union (EU) and the European Economic Area (EEA). This Privacy Policy is also intended to comply with legislation such as UK data protection laws (UK-GDPR), Swiss Federal Data Protection Act and Swiss Data Protection Ordinance (DSG, DSV), California Consumer Privacy Act (CCPA/CPRA), China’s Personal Information Protection Law (PIPL), Delaware Personal Data Privacy Act (DPDPA), Tennessee Information Protection Act (TIPA), Minnesota Consumer Data Privacy Act (MCDPA), Iowa Act Relating to Consumer Data Protection (ICDPA), Maryland Online Data Privacy Act (MODPA), Nebraska Data Privacy Act (NDPA), New Hampshire Consumer Data Privacy Law (SB255), New Jersey Data Privacy Law (SB332), South Carolina Consumer Privacy Bill (House Bill 4696) and other global data protection regulations and shall be interpreted accordingly. The following Privacy Policy shall be interpreted for each country, state or federal state in such a way that the terms and legal bases used correspond to the terms and legal bases used in the respective state or federal state.

For reasons of better readability, the simultaneous use of the language forms male, female, diverse and other gender identities (m/f/d/other) is avoided on our websites, in publications, in communication and in our Privacy Policy. All formulations used apply equally to all genders.

If you have any suggestions for improving the texts in this Privacy Policy or if you want to hire an External Data Protection Officer, please contact the author of the text: Prof. Dr. h.c. Heiko Jonny Maniero, LL.B., LL.M. mult., M.L.E..

1. Definitions

In our Privacy Policy, we use special terms from various data protection laws. We want our statement to be easy to understand and therefore explain these terms in advance.

The following definitions shall be interpreted or expanded, as appropriate, based on the case law of the General Court of the European Union (EGC), the European Court of Justice (ECJ), the Swiss Federal Supreme Court (SFSC), the Supreme Court of the United Kingdom (UKSC) or on national data protection laws or national case law of a state or federal state, including but not limited to California, including case law, also under common law, if this is necessary for the application of the law in individual cases.

We use the following terms, among others, in this Privacy Policy:

a) Personal Data

Personal Data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, or who must be regarded as such under national data protection legislation or national jurisdiction of a state or federal state, including under common law.

b) Data Subject

Data Subject is any identified or identifiable natural person whose Personal Data is processed by the Controller, a Processor, an international organization or another data recipient, and persons who must be regarded as such under national data protection laws or national jurisdiction of a state or federal state, including case law, also under common law.

c) Processing

Processing is any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of Processing

Restriction of Processing is the marking of stored Personal Data with the aim of limiting their Processing in the future.

e) Profiling

Profiling is any form of automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymization

Pseudonymization is the Processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.

g) Controller

The Controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. Where the purposes and means of such Processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

A Processor is a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

i) Recipient

A Recipient is a natural or legal person, public authority, agency or another body, to which the Personal Data are disclosed, whether a Third Party or not. However, public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

j) Third Party

A Third Party is a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor and persons who, under the direct authority of the Controller or Processor, are authorised to process Personal Data.

k) Consent

Consent is any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.

2. Name and address of the Controller

The Controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and the European Economic Area, British data protection laws, Swiss data protection laws (DSG, DSV), Californian data protection law (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and provisions with a data protection nature is:

ZincFive, Inc.
20050 SW 112th Ave., Tualatin,
Oregon 97062
Phone.: +1-503-399-3517
eMail: info@zincfive.com
Website: https://zincfive.com/

3. Name and contact details of the data protection officer

Prof. Dr. h.c. Heiko Jonny Maniero
Franz-Joseph-Str. 11
80801 München
Deutschland
Phone.: +49 (0)178 – 6264376
eMail: info@dg-datenschutz.de

Collection of general data and information

Our websites collect a range of general data and information each time the websites are accessed by a Data Subject or an automated system. This general data and information are stored in the log files of the respective server. Among other things, the (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our websites (so-called referrer), (4) the sub-websites which are accessed via an accessing system on our websites, (5) the date and time of access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information used for security purposes in the event of attacks on our information technology systems can be recorded.

When using this general data and information, we generally do not draw any conclusions about the Data Subject. Rather, this information is required to (1) correctly deliver the content of our websites, (2) optimize the content of our websites and the advertising for them, (3) ensure the long-term functionality of our information technology systems and the technology of our websites and (4) provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. This anonymously collected data and information is therefore evaluated by us both statistically and with the aim of increasing data protection and data security in our organisation to ultimately ensure an optimal level of protection for the Personal Data processed by us. The data of the server log files are stored separately from all Personal Data provided by a Data Subject.

The purpose of processing is to avert danger and ensure IT security, as well as the aforementioned purposes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the protection of our information technology systems. The log files are deleted after the stated purposes have been achieved.

4. Contact possibility via the website and other data transfers and your Consent

Our website contains information that enables quick electronic contact with our organisation as well as direct communication with us, which also includes a general address of the so-called electronic mail (email address) and possibly a telephone number. If a Data Subject contacts us by email, via a contact form, via an input form or in any other way, the Personal Data transmitted by the Data Subject will be stored automatically. This Personal Data transmitted to us on a voluntary basis by a Data Subject is processed for the purposes of usage or contacting the Data Subject.

We obtain your Consent for the transmission, storage and Processing of your contact data and inquiries and for contacting you in accordance with Art. 6 (1) (a) GDPR and Art. 49 (1) (1) (a) GDPR as follows:

By transmitting your Personal Data, you voluntarily consent to the Processing of the Personal Data you have entered or transmitted for the purposes of processing the inquiry and contacting you. By transmitting your data to us, you also voluntarily give your explicit Consent in accordance with Art. 49 (1) (1) (a) GDPR to data transfers to third countries to and by the companies named in this Privacy Policy and for the purposes stated, in particular for such transfers to third countries for which there is or is not an adequacy decision by the EU/EEA and to companies or other bodies that are not subject to an existing adequacy decision on the basis of self-certification or other accession criteria and in which or for which there are significant risks and no suitable guarantees for the protection of your Personal Data (e.g., due to Section 702 FISA, Executive Order EO12333 and the CloudAct in the USA). When you gave your voluntary and explicit Consent, you were aware that there may not be an adequate level of data protection in third countries and that your data subject rights may not be enforceable. You can withdraw your Consent under data protection law at any time with effect for the future. The withdrawal of Consent does not affect the lawfulness of Processing based on Consent before its withdrawal. With a single action (entry and transmission), you give several Consents. These are Consents under EU/EEA data protection law as well as those under the CCPA/CPRA, ePrivacy and telemedia law, and other international legislation, which are required, among other things, as a legal basis for any planned further Processing of your Personal Data. With your action, you also confirm that you have read and taken note of this Privacy Policy.

5. Routine deletion and restriction of Personal Data

We process and store Personal Data for the period required to achieve the purpose of processing or if this has been provided for by the European legislator or another legislator in laws or regulations to which we are subject, or if a legal basis for the Processing exists.

If the purpose of processing no longer applies or if a storage period prescribed by the European legislator or another competent legislator expires, or if the legal basis for the Processing no longer applies, the Personal Data will be routinely restricted or deleted in accordance with the statutory provisions.

6. Rights of the Data Subject according to GDPR

a) Right to confirmation

Each Data Subject has the right to obtain from the Controller confirmation as to whether or not Personal Data concerning him or her is being processed.

If a Data Subject wishes to exercise this right, he or she may contact us at any time.

b) Right to information

Each Data Subject has the right to obtain from the Controller free information about the Personal Data stored about him/her and a copy of this data at any time. Furthermore, the European legislator has granted the Data Subject access to the following information:

the purposes of processing,
the categories of Personal Data that are processed,
the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organizations,
where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period,
the existence of the right to request from the Controller rectification or erasure of Personal Data or Restriction of Processing of Personal Data concerning the Data Subject or to object to such Processing,
the existence of a right to lodge a complaint with a supervisory authority,
if the Personal Data is not collected from the Data Subject: All available information about the origin of the data,
the existence of automated decision-making, including Profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject.

Furthermore, the Data Subject has a right to information as to whether Personal Data has been transferred to a third country or to an international organization. If this is the case, the Data Subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.

If a Data Subject wishes to exercise this right, he or she may contact us at any time.

c) Right to rectification

Each Data Subject has the right to demand the immediate correction of incorrect Personal Data concerning them. Furthermore, the Data Subject has the right to request the completion of incomplete Personal Data, including by means of a supplementary declaration, taking into account the purposes of the Processing.

If a Data Subject wishes to exercise this right, he or she may contact us at any time.

d) Right to erasure (right to be forgotten)

Each Data Subject has the right, to obtain from the Controller the erasure of Personal Data concerning him or her without undue delay, and the Controller shall have the obligation to erase Personal Data without undue delay where one of the following grounds applies, as long as the Processing is not necessary:

Personal Data was collected or otherwise processed for purposes for which it is no longer necessary.
The Data Subject withdraws Consent on which the Processing is based according to Art. 6 (1) (a) GDPR, or Art. 9 (2) (a) GDPR, and where there is no other legal ground for the Processing.
The Data Subject objects to the Processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the Processing, or the Data Subject objects to the Processing pursuant to Art. 21 (2) GDPR.
Personal Data was processed unlawfully.
The deletion of Personal Data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the Controller is subject.
The Personal Data was collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.

If one of the aforementioned reasons applies, and a Data Subject wishes to request the erasure of Personal Data stored by us, he or she may contact us at any time.

If we have made the Personal Data public and if our organisation is obliged to delete the Personal Data in accordance with Art. 17 (1) GDPR, we shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform other data Controllers who process the published Personal Data that the Data Subject has requested the deletion of all links to this Personal Data or of copies or replications of this Personal Data from these other data Controllers, insofar as the Processing is not necessary.

e) Right to Restriction of Processing

Each Data Subject has the right to obtain from the Controller Restriction of Processing where one of the following applies:

The accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data.
The Processing is unlawful, and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead.
The Controller no longer needs the Personal Data for the purposes of the Processing, but they are required by the Data Subject for the establishment, exercise or defense of legal claims.
The Data Subject has objected to Processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.

If one of the aforementioned conditions is met, and a Data Subject wishes to request the restriction of the Processing of Personal Data stored by us, he or she may contact us at any time.

f) Right to data portability

Each Data Subject has the right to receive the Personal Data concerning him or her, which he or she has provided to a Controller, in a structured, commonly used and machine-readable format. He or she also has the right to transmit those data to another Controller without hindrance from the Controller to which the Personal Data have been provided, where Processing is based on Consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the Processing is carried out by automated means, unless the Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

Furthermore, in exercising their right to data portability pursuant to Art. 20 (1) GDPR, the Data Subject has the right to have the Personal Data transmitted directly from one Controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

If a Data Subject wishes to exercise this right, he or she may contact us at any time.

g) Right to object

Each Data Subject has the right to object, on grounds relating to his or her particular situation, at any time, to Processing of Personal Data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to Profiling based on these provisions.

In the event of an objection, we will no longer process the Personal Data unless we can demonstrate compelling legitimate grounds for the Processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of legal claims.

If we process Personal Data for direct marketing purposes, the Data Subject shall have the right to object at any time to Processing of Personal Data concerning him or her for such marketing. This also applies to Profiling insofar as it is associated with such direct advertising. If the Data Subject objects to us to the Processing for direct marketing purposes, we will no longer process the Personal Data for these purposes.

In addition, the Data Subject has the right, on grounds relating to his or her particular situation, to object to Processing of Personal Data concerning him or her by us for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the Processing is necessary for the performance of a task carried out for reasons of public interest.

If a Data Subject wishes to exercise this right, he or she may contact us at any time. The Data Subject is also free, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to exercise his or her right to object by automated means using technical specifications.

h) Automated decisions in individual cases including Profiling

Each Data Subject has the right not to be subject to a decision based solely on automated Processing, including Profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, provided that the decision (1) is not necessary for the conclusion or performance of a contract between the Data Subject and the Controller, or (2) is authorized by Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests, or (3) is based on the Data Subject’s explicit Consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the Data Subject and a data Controller, or (2) it is based on the Data Subject’s explicit Consent, we shall implement suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express his or her point of view and contest the decision.

If a Data Subject wishes to exercise this right, he or she may contact us at any time.

i) Right to withdraw Consent under data protection law

Each Data Subject has the right to withdraw Consent to the Processing of Personal Data at any time.

If a Data Subject wishes to exercise this right, he or she may contact us at any time.

7. General purpose of Processing, categories of processed data and categories of recipients

The general purpose of processing Personal Data is the handling of all activities relating to the Controller, customers, interested parties, business partners or other contractual or pre-contractual relationships between the aforementioned groups (in the broadest sense) or legal obligations of the Controller. This general purpose applies if no more specific purposes for specific Processing are specified.

The categories of Personal Data that we process are customer data, prospective customer data, employee data (including applicant data) and supplier data. The categories of recipients of Personal Data are public bodies, external bodies, internal processing, intragroup processing and other bodies.

A list of our Processors and data recipients in third countries and, if applicable, international organizations is either published on our website or can be requested from us free of charge.

8. Legal basis for the Processing

Art. 6 (1) (a) GDPR serves as the legal basis for Processing operations for which we obtain Consent for a specific Processing purpose. If the Processing of Personal Data is necessary for the performance of a contract to which the Data Subject is party, as is the case, for example, when Processing operations are necessary for the supply of goods or to provide any other service or consideration, Processing is based on Art. 6 (1) (b) GDPR. The same applies to such Processing operations that are necessary to carry out pre-contractual measures, for example in cases of inquiries about our products or services. If we are subject to a legal obligation which requires the Processing of Personal Data, such as for the fulfillment of tax obligations, Processing is based on Art. 6 (1) (c) GDPR.

In rare cases, it may be necessary to process Personal Data to protect the vital interests of the Data Subject or another natural person. This would be the case, for example, if a visitor were injured in our organisation and their name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other Third Party. The Processing would then be based on Art. 6 (1) (d) GDPR.

If the Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, the legal basis is Art. 6 (1) (e) GDPR.

Ultimately, Processing operations could be based on Art. 6 (1) (f) GDPR. This legal basis is used for Processing operations which are not covered by any of the abovementioned legal grounds, if Processing is necessary for the purposes of the legitimate interests pursued by our organisation or by a Third Party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data. We are permitted to carry out such Processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed, for example, if the Data Subject is a customer of the Controller (Recital 47 Sentence 2 GDPR).

9. Legitimate interests in Processing pursued by the Controller or a Third Party and direct marketing

If the Processing of Personal Data is based on Art. 6 (1) (f) GDPR and no more specific legitimate interests are stated, our legitimate interest is the performance of our business activities for the benefit of the well-being of our staff and our shareholders.

We may send you direct advertising about our own goods or services that are similar to the goods or services you have requested, commissioned or purchased. You may object to direct advertising at any time (e.g. by email). You will not incur any costs other than the transmission costs according to the basic rates. The Processing of Personal Data for direct marketing purposes is based on Art. 6 (1) (f) GDPR. The legitimate interest is direct marketing.

Our messages and newsletters may also constitute direct marketing communications within the meaning of Article 13(2) of EU Directive 2002/58 (Directive on privacy and electronic communications) and the national law resulting from the Directive, provided that we have obtained your electronic and other contact information in connection with the sale of a service or product, which includes the creation of a free user account that allows you, among other things, to access free content on our websites and publications (newsletters, etc.), provided that we advertise similar products or services through direct marketing, so that direct marketing is also permissible without consent (see ECJ, judgment of November 13, 2025, Case C 654/23). In such cases, you can refuse the use of your contact information at any time free of charge.

10. Duration for which the Personal Data is stored

The criterion for the duration of the storage of Personal Data is the respective statutory retention period. If there is no statutory retention period, the criterion is the contractual or internal retention period. After this period has expired, the corresponding data is routinely deleted if it is no longer required to fulfill or initiate a contract. This applies in particular to all Processing operations for which no more specific criteria have been defined.

11. Legal or contractual provisions for the provision of Personal Data; necessity for the conclusion of the contract; obligation of the Data Subject to provide the Personal Data; possible consequences of non-provision

We would like to inform you that the provision of Personal Data is partly required by law (e.g., tax regulations) or may also result from contractual obligations (e.g., information on the contractual partner). Sometimes it may be necessary for a contract to be concluded for a Data Subject to provide us with Personal Data that must subsequently be processed by us. For example, Data Subjects are obliged to provide us with Personal Data if our organisation concludes a contract with them. Failure to provide Personal Data would mean that the contract with the Data Subject could not be concluded. The Data Subject must contact us before providing Personal Data. We will inform the Data Subject on a case-by-case basis whether the provision of the Personal Data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the Personal Data and what the consequences would be if the Personal Data were not provided.

12. Existence of automated decision-making

As a responsible company, we do not normally use automated decision-making or Profiling. If, in exceptional cases, we carry out automated decision-making or Profiling, we will inform the Data Subject either separately or via a sub-item in our Privacy Policy (here on our website). In this case, the following applies:

Automated decision-making, including Profiling, may take place if (1) this is necessary for the conclusion or performance of a contract between the Data Subject and us, or (2) this is permissible on the basis of Union or Member State legislation to which we are subject and this legislation contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the Data Subject, or (3) this takes place with the explicit Consent of the Data Subject.

In the cases referred to in Art. 22 (2) (a) and (c) GDPR, we shall implement suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests. In these cases, you have the right to obtain human intervention on the part of the Controller, to express your point of view and to contest the decision.

Meaningful information on the logic involved and the scope and intended effects of such Processing for the Data Subject will be provided in this Privacy Policy where applicable.

13. Recipients in a third country and appropriate or adequate safeguards and how to obtain a copy of them or where they are available.

According to Art. 46 (1) GDPR, the Controller or Processor may only transfer Personal Data to a third country if the Controller or Processor has provided appropriate safeguards and if enforceable rights and effective legal remedies are available to the Data Subjects. Appropriate safeguards can be provided by standard contractual clauses without the need for special approval from a supervisory authority, Art. 46 (2) (c) GDPR.

The EU standard contractual clauses or other appropriate safeguards are agreed with all recipients from third countries prior to the first transfer of Personal Data, or the transfers are based on adequacy decisions. Consequently, it is ensured that appropriate safeguards, enforceable rights and effective legal remedies are guaranteed for all Processing of Personal Data. Any Data Subject can obtain a copy of the standard contractual clauses or adequacy decisions from us. In addition, the standard contractual clauses and adequacy decisions are available in the Official Journal of the European Union.

Art. 45 (3) GDPR authorizes the European Commission to decide by means of an implementing decision that a non-EU country ensures an adequate level of protection. This means a level of protection for Personal Data that essentially corresponds to the level of protection within the EU. Adequacy decisions mean that Personal Data can flow from the EU (as well as from Norway, Liechtenstein and Iceland) to a third country without further obstacles. Similar regulations apply to the United Kingdom, Switzerland and some other countries.

In all cases where the European Commission, or a government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists (e.g., EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework), all transfers by us to the members of such frameworks (e.g., self-certified entities) are based solely on the membership of that entity in the respective framework or on the respective adequacy decisions. If we or one of our group companies is a member of such a framework, all transfers to us or our group company are based exclusively on the membership of the respective company in this framework. If we or one of our group companies is located in a third country with an adequate level of protection, all transfers to us or our group company are based solely on the respective adequacy decisions.

Any Data Subject can obtain a copy of the frameworks from us. In addition, the frameworks are also available in the Official Journal of the European Union or in the published legal materials or on the websites of data protection supervisory authorities or other authorities or institutions.

14. Right to lodge a complaint with a data protection supervisory authority

As the Controller, we are obliged to inform the Data Subject of the existence of the right to lodge a complaint with a supervisory authority. The right to lodge a complaint is regulated in Art. 77 (1) GDPR. According to this provision, without prejudice to any other administrative or judicial remedy, every Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the Data Subject considers that the Processing of Personal Data relating to him or her infringes the General Data Protection Regulation. The right to lodge a complaint has been restricted by the EU legislator to the effect that it can only be exercised with a single supervisory authority (Recital 141 Sentence 1 GDPR). This provision is intended to avoid duplicate complaints in the same matter by the same Data Subject. If a Data Subject wishes to complain about us, it is therefore requested that only one supervisory authority is contacted.

15. Data protection for applications and in the application process

We collect and process Personal Data of applicants in the application process. Processing may also take place electronically. This is particularly the case if an applicant submits relevant application documents to us electronically, for example by email or via a web form on our or third-party websites.

For applicant data, the purpose of data processing is to carry out a review of the application in the application process. For this purpose, we process all data provided by you. Based on the data submitted as part of the application, we check whether you will be invited to an interview (part of the selection process). Then, in the case of generally suitable applicants, in particular during the interview, we process certain other Personal Data provided by you that is essential for our selection decision.

The legal basis for data Processing is Art. 6 (1) (b) GDPR, Art. 9 (2) (b) and (h) GDPR, Art. 88 (1) GDPR and national legislation.

If we do not conclude an employment contract with the applicant, the application documents will be deleted no later than six months after notification of the rejection decision, provided that no other legitimate interests of the Controller stand in the way of deletion. Another legitimate interest in this sense is, for example, the provision of evidence in legal proceedings.

16. Registration or filling in input masks on our website and your Consent

You have the option of registering on our websites by providing Personal Data and/or filling out input masks. Which Personal Data is transmitted to us in the process is determined by the respective input mask used for registration or input. The Personal Data you enter will be processed exclusively for internal use by us and for our own purposes. However, we may pass on your Personal Data to one or more Processors, for example to parcel service providers, who also use your Personal Data exclusively for purposes that are attributable to us as the Controller. Disclosure may also take place if you have commissioned the disclosure from us. The legal basis is then Art. 6 (1) (b) GDPR.

When you register or enter data on our website, the IP address assigned by your internet service provider (ISP), the date and time of registration or entry may also be stored. This data is stored against the background that this is the only way to prevent misuse of our services and, if necessary, to make it possible to investigate criminal offenses. In this respect, the storage of this data is necessary for our security. The purpose of processing is the prevention and detection of misuse and the investigation of criminal offenses, as well as the aforementioned purposes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is in particular the protection of our information technology systems and the investigation of criminal offenses. This data is not disclosed to Third Parties unless there is a legal obligation to disclose it, or the disclosure serves the purpose of criminal prosecution.

The registration, entry and transmission of your Personal Data also enables us to offer you content or services which, due to the nature of the matter, can only be offered to registered persons or persons known to us. You are free to change the Personal Data provided during registration at any time or to have it completely deleted from our database. The purposes of processing are the receipt of data by us and the use of your data for further Processing, for communication with you and the illustration or implementation of the registration or input purposes. The legal basis is your Consent in accordance with Art. 6 (1) (a) GDPR and/or Art. 49 (1) (1) (a) GDPR.

By entering and transmitting your data, you voluntarily consent to the Processing of the Personal Data you have entered. By entering and transmitting your data to us, you also voluntarily give your explicit Consent in accordance with Art. 49 (1) (1) (a) GDPR to data transfers to third countries to and by the companies named in this Privacy Policy and for the purposes stated, in particular for such transfers to third countries for which there is or is not an adequacy decision by the EU/EEA and to companies or other bodies that are not subject to an existing adequacy decision on the basis of self-certification or other accession criteria and in which or for which there are significant risks and no suitable guarantees for the protection of your Personal Data (e.g., due to Section 702 FISA, Executive Order EO12333 and the CloudAct in the USA). When giving your voluntary and explicit Consent, you were aware that there may not be an adequate level of data protection in third countries and that your data subject rights may not be enforceable. You can withdraw your Consent under data protection law at any time with effect for the future. The withdrawal of Consent does not affect the lawfulness of Processing based on Consent before its withdrawal. With a single action (entry and transmission), you give several Consents. These are Consents under EU/EEA data protection law as well as those under the CCPA/CPRA, ePrivacy and telemedia law, and other international legislation, which are required, among other things, as a legal basis for any planned further Processing of your Personal Data. With your action, you also confirm that you have read and taken note of this Privacy Policy.

Upon request, we will provide any Data Subject at any time with information about which Personal Data about the Data Subject is stored. We will also correct or delete Personal Data at the request or notice of the Data Subject, provided that this does not conflict with any statutory retention obligations or other reasons justifying Processing. All our employees are available to you as contact persons in this context.

17. Blog and comment function

A blog is a portal, usually open to the public, in which one or more people, called bloggers or web bloggers, post articles or publish thoughts in so-called blog posts. You can leave individual comments on blog posts in our blog.

If you leave your own comments on our blog, information about the time you entered the comments and your username (possibly a pseudonym) will be stored, published and distributed in addition to the comments. By submitting comments, you conclude a publication contract with us, which grants us free of charge and irrevocably all worldwide copyright usage rights that you are entitled to. This includes, in particular, the rights to reproduce, distribute and make publicly available all comments submitted by you. The legal basis for the Processing is therefore Art. 6 (1) (b) GDPR.

The purposes of Processing are the provision of a blog with a comment function and granting the opportunity to submit comments.

Furthermore, the IP address assigned to your internet connection by your internet service provider (ISP) is logged when you post a comment. The IP address is stored for security reasons and for the case you violate the rights of Third Parties or post illegal content by posting a comment. The storage of this Personal Data is therefore in our own interest so that we can exculpate ourselves in the event of an infringement. The above purposes are the legitimate interests pursued by the Controller (Art. 6 (1) (f) GDPR). This data will not be passed on to Third Parties unless there is a legal obligation to pass it on or the passing on serves the purpose of criminal prosecution or exculpation.

18. Data protection provisions about the application and use of ADP

ADP is a leading provider of cloud-based solutions in the field of human resources (HR), payroll, personnel management and working time management. When using ADP, personal data such as contact information, salary data, tax information and working hours are processed in order to manage payroll and HR services and to ensure compliance with legal regulations. This data is used to run payroll, manage employee data and calculate taxes and social security contributions.

The company that operates the service and therefore the recipient of the personal data is: ADP, Inc., One ADP Boulevard, Roseland, NJ 07068, USA.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of the processing is the administration of HR services, payroll and other personnel management processes. Processing is based on Art. 6 (1) (b) GDPR, as it is necessary for the performance of a contract to which the data subject is a party, and on Art. 6 (1) (c) GDPR, as it is necessary for compliance with a legal obligation.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may have concluded one of the EU Standard Contractual Clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of ADP may be retrieved under https://www.adp.com/.

19. Data protection provisions about the application and use of Google APIs

We use Google APIs to integrate functions such as geodata, calendar integration, cloud storage or database access into our applications and services. These programming interfaces allow us to access user data, device information, and system-relevant services and thus, for example, to synchronize appointments, visualize locations or retrieve cloud content. As part of this processing activity, personal data may be processed – especially when users link Google accounts or data requests are triggered. The data processed includes names, email address, calendar data or document information, location data, IP address, device type, browser information, times of use, API requests and associated metadata.

Processing is automated via Google’s cloud infrastructure. When API calls are made, our application sends requests to Google servers that return or update user information. Google processes this data to verify access rights, provide content and enable functions such as synchronization or analysis.

The company that operates the service and therefore the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of the processing is the use of Google APIs. Processing is based on Art. 6 (1) (f) GDPR, whereby the legitimate interest lies in the efficient implementation of processes using APIs.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. However, if you do not provide it, you may not be able to use our services or those of the company that operates the service.

Further information and the applicable data protection provisions can be found at https://support.google.com.

20. Data protection provisions about the application and use of Google Site Verification

We use Google Site Verification service to verify our website with Google. This verification is a prerequisite for the use of other Google services such as Google Search Console, Google Analytics or Google Ads. As part of Site Verification, a verification token is integrated using various methods (e.g., HTML file, meta tag, DNS entry or Google Tag Manager) in order to prove ownership of the domain. When using the service, personal data may be processed, in particular in the form of IP addresses, technical access data and information about the domain, the website or the Google account used.

Processing is automated via Google servers. After successful verification, the website property is stored in the Google account of the verifying user.

The company that operates the service and therefore the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of the processing is the technical verification of domain ownership for the activation of Google services such as Search Console or Analytics. The processing is carried out on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in the use of Google tools, the proper assignment of services to the domain and the technical protection of accounts against misuse.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Google may be retrieved under https://policies.google.com/privacy.

21. Data protection provisions about the application and use of Microsoft Edge

We use the Microsoft Edge web browser. When using the browser, personal data may be processed by Microsoft, in particular when using functions such as synchronization with the Microsoft account, the use of extensions, search integration via Bing or the personalized display of content. When you visit a website, Microsoft Edge processes various technical information that is required to display content and interact with online services. This includes IP addresses, browser types and versions, language settings, operating systems used, device identifiers, location data, cookies, stored form data, and URLs visited.

Microsoft Edge can also be linked to other Microsoft services, e.g., for protection against malicious websites (SmartScreen), Microsoft 365 accounts or the synchronization of bookmarks and passwords. Personal data may be transmitted to Microsoft for identification, usage analysis, and security enhancement. Users can activate or deactivate these functions in the browser settings.

The company that operates the service and thus the recipient of personal data is: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. For data subjects in the EU and EEA, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Microsoft Limited, Microsoft Campus, Thames Valley Park, Reading, RG6 1WG, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Microsoft Schweiz GmbH, Seestrasse 356, 8038 Zurich, Switzerland.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of processing is to provide a modern web browser with advanced features for display, interaction and security when using online content. The processing is carried out on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in the secure, convenient, and feature-rich use of web services, the synchronization of cross-device settings and the improvement of browser performance and browser security.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the company that operates the service with personal data. However, if you do not provide personal data, certain functions of the browser may not be fully usable.

Further information and the applicable data protection provisions of Microsoft may be retrieved under https://privacy.microsoft.com/.

22. Data protection provisions about the application and use of Microsoft Login / Sign-In

We use the Microsoft Login / Sign-In service to provide users with secure authentication when using our web-based applications and systems. This service is part of the Microsoft Entra Identity Platform (formerly Azure Active Directory) and allows users to log in to our applications with a Microsoft account or an Azure AD account. Personal data is processed to enable access to authorized areas, manage user accounts and verify the identity of the respective person. The data processed includes names, email addresses, user IDs, IP addresses, device types, browser used, language settings, timestamps, location data, authentication information, login logs, and usage logs.

As part of the authentication process, Microsoft also processes security-relevant information such as multi-factor authentication data, tokens, session cookies and access rights. This data is used to protect against unauthorized access and to securely manage user identities. Processing takes place both automatically via Microsoft’s cloud infrastructure and via configurable interfaces that are integrated into our applications. In addition, Microsoft can collect usage statistics to improve the performance, security and reliability of the service. The data is processed in data centers that may be located both inside and outside the European Economic Area.

Purposes for which personal data are to be processed and the legal basis for the processing: The processing serves the authentication of users, access control to protected system areas, the administration of user rights and the security of the IT infrastructure. Processing is carried out on the basis of Art. 6 (1) (b) GDPR, i.e., for the performance of a contract to which the data subject is party, and Art. 6 (1) (f) GDPR. The legitimate interest lies in the secure and reliable management of user identities, the prevention of unauthorized access, compliance with internal security standards and integration into existing Microsoft services and platforms.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. However, if you do not provide personal data, you may not be able to use our services or those of the company that operates the service.

Further information and the applicable data protection provisions of Microsoft may be retrieved under https://privacy.microsoft.com/.

23. Data protection provisions about the application and use of HubSpot

HubSpot, Inc. provides a comprehensive inbound marketing, sales and customer service platform that helps businesses attract visitors, convert leads, acquire and retain customers. HubSpot software includes a wide range of tools and features, including content management, social media marketing, email marketing, lead management, analytics, CRM and customer support. This integrated solution enables companies to optimize their marketing and sales processes and create a better customer experience.

When using HubSpot, Personal Data such as names, email addresses, telephone numbers, company information, interaction data (e.g., website visits, email openings, clicks) and in certain cases, payment information is processed. This data helps companies to better understand their customers and potential customers and to plan and implement targeted marketing, sales and service activities.

The company that operates the service and thus the recipient of personal data is: HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. For data subjects in the EU and EEA, HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: HubSpot UK, 199 Bishopsgate, London EC2M 3T, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of the marketing, sales and service platform. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the Data Subject is party and Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving business processes, increasing customer satisfaction and supporting our growth.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of HubSpot may be retrieved under https://legal.hubspot.com.

24. Data protection provisions about the application and use of Microsoft Teams

Microsoft Teams is a communication and collaboration tool within the Microsoft 365 suite designed specifically for business use. It enables teams to work together effectively, no matter where they are, through features such as chat, video calls, meetings, file sharing and integration with other Microsoft products and services. Microsoft Teams promotes teamwork through digital spaces that enable seamless communication and collaboration, regardless of whether team members are in the same office or spread across various locations worldwide.

When using Microsoft Teams, Personal Data such as names, email addresses, telephone numbers, usage data (e.g., time and duration of meetings, chat logs), content data (e.g., files, notes, messages) and location data are processed. This information is necessary to provide the services, improve the user’s experience, provide support and ensure the security and compliance of the services.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use, provide, manage and improve Microsoft Teams for communication. Processing is based on the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is party and on legitimate interests (Art. 6 (1) (f) GDPR), such as the improvement of our services and the use and provision of modern communication tools.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Microsoft Teams can be found at https://privacy.microsoft.com.

25. Data protection provisions about the application and use of Microsoft SharePoint

We use Microsoft SharePoint to efficiently organize internal and cross-departmental collaboration, document management, team sites, intranet functions and information exchange. The platform enables us to store, jointly edit and share documents, calendars, task lists and content in a structured manner. Personal data may be processed during use – in particular, data contained in documents, user profiles, approvals or comments. Processed data includes names, email address, user profile details, document content, metadata (e.g., file uploads, versions, shares), IP address, timestamp, device data, user actions and participant-related communication data.

Processing is automated via the Microsoft 365 cloud infrastructure. SharePoint stores and manages data centrally in online libraries and enables real-time collaboration and workflow control. Access is controlled via role-based access rights, and all data transfers are encrypted.

The company that operates the service and thus the recipient of the personal data is: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. For data subjects in the EU and EEA, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Microsoft Limited, Microsoft Campus, Thames Valley Park, Reading, RG6 1WG, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Microsoft Schweiz GmbH, Seestrasse 356, 8038 Zurich, Switzerland.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service is a certified member of the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework. You can find more information at dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Purposes for which the personal data are to be processed and the legal basis for the processing: The purpose of the processing is to provide a structured and secure collaborative environment, to manage document processes and content workflows, to share knowledge and to support team collaboration and communication. The processing is carried out on the basis of Art. 6 (1) (b) GDPR, for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract and Art. 6 (1) (f) GDPR. The legitimate interest lies in the efficient organization of our internal processes, the guarantee of high-quality cooperation and the protection of sensitive information through technical and organizational measures.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract or necessary for the conclusion of a contract. You are not obliged to provide us or the operating company with personal data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Microsoft SharePoint can be found at https://www.microsoft.com.

26. Data protection provisions about the application and use of Cloudflare

Cloudflare offers a wide range of services to improve the security, performance and reliability of websites and web applications. Core features include DDoS protection, web application firewall, content delivery network services, secure DNS services and more. By using Cloudflare, we can protect our online presence from cyber-attacks, improve the loading speed of our website and ensure the overall availability of our services.

When using Cloudflare services, data such as IP addresses, system configurations and network traffic information is processed. This information is necessary to ward off threats, optimize data traffic and provide insights into website usage.

The company that operates the service and thus the recipient of personal data is: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. For data subjects in the EU and EEA, Cloudflare Netherlands B.V., Keizersgracht 62, 1015CS Amsterdam, Netherlands, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Cloudflare, Ltd., County Hall/The Riverside Building, Belvedere Road, London, SE1 7PB, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use of services to secure and optimize websites and web applications. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in ensuring the security, performance and reliability of our online presence.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Cloudflare, Inc. can be found at https://www.cloudflare.com.

27. Data protection provisions about the application and use of Google Gstatic

We use content provided by Google via the domain www.gstatic.com to make our website technically efficient. Gstatic is a static content delivery domain via which Google loads various files such as JavaScript libraries, stylesheets, framework components or media content. The aim of this service is to reduce loading times, increase stability and provide recurring content via a high-performance infrastructure. When accessing resources that are integrated via Gstatic, personal data may be processed – in particular, technical connection data. Among other things, IP addresses, device type, browser information, operating system, requested file, language settings, timestamps and, if applicable, referrer URLs are processed.

Processing takes place automatically via Google’s servers as soon as a user visits our website and an element (e.g., a script or a library) is retrieved from Gstatic.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of the processing is the efficient provision of static content on our website via a global content delivery network. The processing is carried out on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in reducing the server load, improving the loading speed, the error-free technical presentation of website content and ensuring stable user experience.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Google may be retrieved under https://policies.google.com/privacy.

28. Data protection provisions about the application and use of jsDelivr

jsDelivr is a public, free content delivery network that enables developers to efficiently host and deliver web libraries, jQuery plugins, CSS frameworks, fonts and other JavaScript resources. By using jsDelivr, web developers can improve the load times of their websites by ensuring that these resources are loaded from servers that are geographically closer to the end users.

When using jsDelivr, data such as users’ IP addresses, type of resources requested, time of access and browser information are processed. This data is collected for the provision of the service, performance optimization and security purposes. jsDelivr uses data protection and security measures to protect the data collected, with particular attention paid to compliance with the General Data Protection Regulation and other data protection laws.

The company that operates the service and thus the recipient of personal data is: Volentio JSD Limited, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the efficient provision of web content via the CDN. The Processing is carried out on the basis of legitimate interests in accordance with Art. 6 (1) (f) GDPR, namely optimizing the loading times of websites, improving the user experience and ensuring the security of the service.

Further information and the applicable data protection provisions of jsDelivr may be retrieved under https://www.jsdelivr.com.

29. Data protection provisions about the application and use of Google Fonts

Google Fonts is a free service from Google LLC that provides web developers with a wide range of fonts to improve the design and aesthetics of websites. By integrating Google Fonts, web developers can ensure that texts on their websites are displayed consistently and as intended on different devices and browsers. Google Fonts is provided via Google servers, ensuring high availability and fast loading times.

When using Google Fonts, Personal Data such as IP addresses and browser information may be processed, as a request is sent to the Google servers when the fonts are loaded. This data is used to provide the service, optimize performance and prevent misuse.

The company that operates the service and thus the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use and optimize the font service for web developers and end users. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the user experience on websites by providing a variety of fonts and ensuring fast loading times.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Google Fonts can be found at https://policies.google.com/privacy.

30. Data protection provisions about the application and use of Hotjar

Hotjar is an analytics and feedback tool that provides web developers and marketing personnel with insight into website visitor behavior. Through a combination of visitor recordings, surveys and feedback, Hotjar helps our organisation understand how users interact with our website, where improvements are needed and how the overall user experience can be optimized.

When using Hotjar, Personal Data such as IP addresses, user behavior (clicks, mouse movements, scrolling behavior), device and browser information as well as responses to surveys and feedback, which may contain Personal Data, are processed. This data helps to analyze the use of the website and to collect direct user feedback.

The company that operates the service and thus the recipient of personal data is: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta. The representative under national law in the United Kingdom is: Hotjar UK Limited, 10 Devonshire Square, London, EC2M 4YP, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to analyze user behavior on websites and to collect user feedback to improve the user experience. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in the optimization of the website and the improvement of user satisfaction.

Further information and the applicable data protection provisions of Hotjar may be retrieved under https://www.hotjar.com.

31. Data protection provisions about the application and use of Atlassian

Atlassian develops software solutions that enable teams to work more efficiently. The main products include Jira for project tracking, Confluence as a collaboration platform, Bitbucket for version control and Trello for task management. These tools help teams to plan, organize and track their work, promoting productivity and collaboration.

When using the Atlassian services, Personal Data such as names, email addresses and professional information are processed. This information is used by Atlassian to offer the services, personalize the functions and improve the user experience.

The company that operates the service and thus the recipient of personal data is: Atlassian Pty Ltd, Level 6, 341 George Street, Sydney NSW 2000, Australia. For data subjects in the EU and EEA, Atlassian B.V., Singel 236, 1016 AB, Amsterdam, The Netherlands, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Atlassian (UK) Operations Limited, c/o Herbert Smith Freehills LLP, Exchange House, Primrose Street, London EC2A 2EG, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The Processing of the data serves the purpose of enabling the use of the software solutions and services, including task management, team communication, documentation and code management. The legal basis is Art. 6 (1) (b) GDPR for contracts to which the Data Subject is a party and Art. 6 (1) (f) GDPR (legitimate interest) for Processing that serves to improve our services and the use of the platform.

The company that operates the service is based in a third country. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may have concluded one of the EU Standard Contractual Clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Atlassian may be retrieved under https://www.atlassian.com.

32. Data protection provisions about the application and use of Cloudflare Email Protection

We use Cloudflare Email Protection to secure our email traffic against threats such as phishing, spoofing, malware and targeted attacks. The service is part of the Cloudflare Zero Trust platform and protects inbound and outbound emails by applying advanced filtering mechanisms, behavioral analysis and real-time scanning. In this context, personal data can be processed, especially if it is contained in email content, attachments or the associated metadata. Processed data includes sender data and recipient addresses, subject lines, header information, email content, IP addresses, location data, file attachments, timestamps and security-related connection data and event data.

Cloudflare automatically analyzes the transmitted emails via globally distributed data centers. The service detects and blocks suspicious messages, flags potential threats and stores security-relevant information for further analysis. In addition, connection data is logged in order to detect anomalies, prevent misuse and improve the effectiveness of protective measures. The Cloudflare Email Protection solution is also used to fulfill compliance requirements and to document security-relevant email processes.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of processing is to protect email communication from attacks and manipulation, to analyze and filter potentially harmful content, to ensure a stable and secure email infrastructure and to comply with internal company security guidelines. Processing is carried out on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in the protection against cyber threats, the integrity of our communication systems and the security of our employees and business partners.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. However, if personal data is not provided, it may not be possible to use our services or those of the company that operates the service.

Further information and the applicable data protection provisions of Cloudflare can be retrieved at https://www.cloudflare.com/.

33. Data protection provisions about the application and use of Fortinet

Fortinet is a cybersecurity company that offers a wide range of products and services to protect businesses and organizations of all sizes from advanced threats and cyberattacks. These include solutions such as firewalls, intrusion prevention systems, antivirus, VPN and endpoint security to ensure a comprehensive and coordinated defense against attacks.

When using Fortinet services and products, Personal Data such as names, email addresses, telephone numbers, company information and usage data and technical information are processed. This information is required to provide security services, support requests, deliver product updates and provide users with personalized experience.

The company that operates the service and thus the recipient of personal data is: Fortinet, Inc., 899 Kifer Road, Sunnyvale, CA 94086, USA. For data subjects in the EU and EEA, Fortinet GmbH, Feldbergstr. 35, 60323 Frankfurt am Main, Germany acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Fortinet UK Ltd., Manor Farm Road, Gainsborough House, 2 Manor Park, Reading RG2 0NA, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of data processing is the use of cybersecurity solutions and services. Processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the Data Subject is a party, and on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as ensuring network security, preventing cyber-attacks and improving our IT security.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the statutory or contractual retention periods. The provision of Personal Data is required by law or contract or is necessary for the conclusion of a contract. You are obliged to provide us with Personal Data for this Processing activity.

Further information and the applicable data protection provisions of Fortinet may be retrieved under https://www.fortinet.com.

34. Data protection provisions about the application and use of Microsoft Entra

We use Microsoft Entra to manage identities, access rights and authentication processes. Microsoft Entra is part of the Microsoft cloud platform and includes functions such as single sign-on, multi-factor authentication, role-based access control and identity protection. When using this service, personal data is processed, particularly in the context of logging in, managing user accounts and authorizing access to internal or external resources. The data processed includes first names, surnames, usernames, email addresses, IP addresses, device identifiers, authentication data, roles, group memberships, location data, log data and timestamps of login information and access events.

Data processing is automated via Microsoft’s cloud-based infrastructure. The identity data and access information are used to enable authorized access to services and data, prevent unauthorized access and ensure that only authorized persons can perform certain actions. In addition, Microsoft Entra uses analysis functions to detect potential security risks, identify anomalies in user behavior and initiate appropriate protective measures. The service is provided via Microsoft Azure and can be integrated into other Microsoft systems and third-party applications.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of processing is the central management of digital identities, the protection of user accounts, the authorization of access to applications and resources and the performance of secure login procedures. The processing is carried out on the basis of Art. 6 (1) (b) GDPR, i.e., for the performance of a contract to which the data subject is party, and Art. 6 (1) (f) GDPR. The legitimate interest lies in secure, controlled and traceable user administration, the prevention of misuse and the consistent implementation of IT security guidelines.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. However, if you do not provide personal data, you may not be able to use our services or those of the company that operates the service.

Further information and the applicable data protection provisions of Microsoft Entra may be retrieved under https://privacy.microsoft.com/.

35. Data protection provisions about the application and use of Cloudflare Web Analytics

Cloudflare Web Analytics is a powerful analytics tool that provides us with detailed insights into the behavior of our website visitors. The solution enables us to measure key metrics such as visitor numbers, page views, device types and sources of traffic. By using Cloudflare Web Analytics, we can analyze the performance of our website, improve user experiences and make data-driven decisions to optimize our online presence.

When using Cloudflare Web Analytics, data such as IP addresses, usage data and information about user behavior is processed. This information helps us to monitor the performance and accessibility of our website.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to analyze and improve the performance of our website. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in the optimization of our website and the provision of a better user experience.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Cloudflare Web Analytics can be found at https://www.cloudflare.com.

36. Data protection provisions about the application and use of Google Analytics

Google Analytics is a tool from Google LLC that provides operators of websites and apps with detailed statistics on traffic and user behavior. It enables the collection and analysis of data on website visits, user interactions and conversion rates, which helps operators to understand and optimize their online presence. Google Analytics uses cookies to collect information about user behavior, including page views, time spent on the site and the paths users take on the site.

When using Google Analytics, Personal Data such as IP addresses, browser information and interaction data are processed. This data helps website operators to measure the performance of their website, improve the user experience and develop targeted marketing strategies.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the analysis and optimization of websites, apps, and advertising. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the website, increasing user-friendliness and the effectiveness of online marketing.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Google Analytics can be found at https://policies.google.com/privacy.

37. Data protection provisions about the application and use of DoubleClick

We use DoubleClick, an online advertising service from Google that delivers and optimizes ads embedded on websites. DoubleClick enables the display of targeted advertising by analyzing user interactions, ad placement and clicks. When using the service, personal data is processed, in particular IP addresses, advertising placement information, user IDs via DoubleClick cookies (e.g., DART cookie), referrer URLs, timestamps and technical information about the device.

The company that operates the service and therefore the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London, SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the personal data are to be processed and the legal basis for the processing: The purpose of the processing is the delivery, optimization and analysis of personalized advertising. The processing is carried out on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in the economically efficient design of the advertising offer and in improving the relevance of the content for users.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service as well as statutory or contractual retention periods (e.g., commercial or tax law requirements). The provision of personal data is not required by law or contract but is required for the use of personalized advertising formats. You are not obliged to provide us or the company that operates the service with personal data. If you do not provide it, certain personalized ads cannot be displayed.

Further information and the applicable data protection provisions of DoubleClick can be found at https://doubleclick.net.

38. Data protection provisions about the application and use of Google Tag Manager

Google Tag Manager is a tag management system from Google LLC that allows websites and app operators to easily implement and manage tags for web analytics and marketing optimization tools without having to change the source code of their websites or apps. Tags are small snippets of code that are used to analyze website data, understand user behavior, and monitor the effectiveness of online marketing campaigns. Google Tag Manager supports the integration of a variety of tags, including Google Analytics, Google Ads and many third-party tags.

The service allows users to manage and trigger tags that can collect data. This data is processed and stored by the respective tags and not by the Google Tag Manager.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of using Google Tag Manager is to simplify tag implementation and tag management. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in optimizing and increasing the efficiency of tag management and the associated web analysis and marketing activities.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Google Tag Manager can be found at https://policies.google.com/privacy.

39. Data protection provisions about the application and use of Facebook

Facebook is a social network that offers people the opportunity to connect, share content and communicate online. Users can create profiles, post photos and videos, exchange messages and organize themselves into groups. Facebook also offers companies and organizations a platform for advertising and interacting with their target group.

When using Facebook, Personal Data such as names, email addresses, telephone numbers, usage data, location information, and information on shared content is processed. This data is necessary to provide the platform, offer personalized content and advertising, ensure user safety, and develop new services.

The company that operates the service and thus the recipient of personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent’s Place, London, NW1 3FG, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use and improve the social network functions and network services. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the Data Subject is party and Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the user experience, providing personalized content and advertising and ensuring the security of the network.

The company that operates the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Facebook can be found at https://facebook.com.

40. Data protection provisions about the application and use of Instagram

Instagram is a widely used social network that allows users to share photos and videos, post stories, and interact with followers and friends. Instagram offers a variety of features, including direct messages, IGTV for longer videos, Instagram Live for real-time broadcasts and a Discover page to find added content and users.

When using Instagram, Personal Data such as names, email addresses, telephone numbers, user content (photos, videos, comments, etc.), location data, usage information and, in certain cases, payment information is processed. This data helps to provide the service, ensure the security of the platform, offer personalized advertising, and improve the user experience.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of the social network functions. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the Data Subject is party and Art. 6 (1) (f) GDPR, where our legitimate interest lies in the improvement and personalization of the user experience, the provision of customer support and ensuring the security and integrity of the platform, as well as in the use of the platform and marketing.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Instagram can be viewed at https:// instagram.com.

41. Data protection provisions about the application and use of LinkedIn

LinkedIn is a social network for professional contacts and career development. The platform allows users to create a professional profile, network with colleagues, business partners and potential employers, share professional experiences and skills, and keep up to date with industry news. LinkedIn also provides tools for companies and recruiters to source talent, post job ads and build a brand presence.

When using LinkedIn, Personal Data such as names, email addresses, professional titles and experience, educational background, skills, interests, and platform usage data are processed. This information is necessary to provide and use the service to create networking opportunities, to present personalized content and job offers and to ensure the security of user data.

The company that operates the service and thus the recipient of the Personal Data is: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of network and career services. Processing is based on the Consent of the user (Art. 6 (1) (a) GDPR), the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is party and on legitimate interests (Art. 6 (1) (f) GDPR), such as marketing and recruitment.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of LinkedIn Corporation can be found at https://www.linkedin.com.

42. Data protection provisions about the application and use of Meta Platforms

Meta Platforms is a technology company that operates several social networks and communication platforms, including Facebook, Instagram, WhatsApp, and Messenger. These services enable billions of users worldwide to connect, share content, communicate and build communities around their interests.

When using Meta Platforms’ services, Personal Data such as names, email addresses, telephone numbers, profile information, posts, comments, messages, interactions with content and advertising, location data and payment information are processed. This information is used to provide services, ensure user security, offer personalized content and advertising, and improve the user experience.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use, provide, manage, and improve the social networks and communication services. Processing is based on the Consent of the user (Art. 6 (1) (a) GDPR), the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is party and on legitimate interests (Art. 6 (1) (f) GDPR), such as the use and improvement of the services.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Meta Platforms, Inc. can be found at https://www.facebook.com.

43. Data protection provisions about the application and use of Vimeo

Vimeo provides a platform for sharing, viewing, and creating videos. Vimeo enables creators, video artists, and companies to share, promote and monetize high-quality content with a global audience. The platform is characterized by a user-centric approach that values quality, creative freedom, and a supportive community environment.

When using Vimeo services, Personal Data such as names, email addresses, profile information, video data, interaction data (such as views and likes) and payment information are processed. This data is required to operate the platform, manage user accounts, offer personalized recommendations, improve support, and process payments for premium services.

The company that operates the service and thus the recipient of personal data is: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. For data subjects in the EU and EEA, EDPO (European Data Protection Office), Avenue Huart Hamoir 71, 1030 Brussels, Belgium, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: EDPO Switzerland Sàrl, Rue de Lausanne 37, 1201 Geneva, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of data processing is the use of the video platform. Processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the Data Subject is a party, and on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient platform for videos, the optimization of the user experience and the use of efficient customer support.

Further information and the applicable data protection provisions of Vimeo may be retrieved under https://vimeo.com.

44. Data protection provisions about the application and use of X (formerly Twitter)

X (formerly known as Twitter) is a global platform for public self-expression and real-time conversation. Users can create and share short messages, called tweets, which can include text, images, videos, and links. The platform allows users to follow breaking news, interact with others and participate in global discussions.

When using X, several types of Personal Data are processed, including usernames, email addresses, telephone numbers and location data. This information can be used for account creation, personalization of content, provision of advertising, security purposes and for analytical evaluations.

The company that operates the service and thus the recipient of personal data is: X Corp., 865 FM-1209, Building 2, Bastrop, TX 78602, USA. For data subjects in the EU and EEA, X Internet Unlimited Company, 1 Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: X Schweiz GmbH, c/o Wasag Treuhand AG, Normannenstrasse 8, 3018 Bern, Switzerland.

The Processing of Personal Data takes place, among other things, on the basis of the user’s Consent (Art. 6 (1) (a) GDPR), for the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is a party, or on the basis of legitimate interests (Art. 6 (1) (f) GDPR), such as the use of the platform and the improvement of communication with the public.

Further information and the applicable data protection provisions of X can be found at https://twitter.com/.

45. Data protection provisions about the application and use of YouTube

YouTube is a video sharing and viewing platform used by individuals, artists, businesses, and media companies to publish a variety of content such as music videos, vlogs, educational material and much more. YouTube offers users the ability to upload, share, comment and interact with a broad community.

When using YouTube, Personal Data such as IP addresses, user interactions (e.g., videos viewed, comments), location data (if enabled for services) and information from linked Google accounts are processed. This information is required to provide personalized content and advertising, enable user interactions, keep the platform secure and improve the user experience.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of data processing lies in the use of the video sharing services. Processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the Data Subject is a party, and on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient video platform, the improvement of the user experience, the use of personalized advertising and the use of embedded videos on our website.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of YouTube can be found at https://policies.google.com.

46. Data protection provisions about the application and use of Microsoft Corporation

Microsoft Corporation is a technology company that develops and offers a wide range of software products, services and devices. These include operating systems such as Windows, office software such as Microsoft Office, cloud services via Microsoft Azure, and hardware products such as the Surface range and Xbox games consoles. Microsoft is committed to providing technological solutions that help increase productivity and entertainment in both the professional and private spheres.

When using Microsoft products and services, Personal Data such as names, email addresses, telephone numbers, usage data of the services and software, content data (e.g., emails, documents, photos), location data and payment information are processed. This information is necessary to provide the services, provide customer support, make product improvements and offer personalized experience.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use, provide, manage and improve the products and services. Processing is based on the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is party, the user’s Consent (Art. 6 (1) (a) GDPR) or on legitimate interests (Art. 6 (1) (f) GDPR), such as improving our services, ensuring security and the use of standard software.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and the applicable data protection provisions of Microsoft Corporation may be retrieved under https://privacy.microsoft.com.

47. Data protection provisions about the application and use of Microsoft Copilot

We use Microsoft Copilot within our organization as an AI-supported assistance tool for productive work – for example, when creating texts, summaries, suggestions or data analysis in documents, e-mails and applications. The service helps us to complete tasks more efficiently, provide knowledge information and creative impetus and automate recurring processes. Personal data can be processed during the process – especially data contained in the work content. Processed data includes employee names, email content, document texts, formulations, context data, metadata on files (including access, processing time), IP addresses, device data and log data on usage.

Processing is automated via the Microsoft 365 cloud infrastructure. Copilot accesses contextual content from Word, Outlook, Excel, PowerPoint and Teams to generate suitable suggestions. The data processing steps take place within the Microsoft environment and are subject to technical and organizational security measures such as encryption, role-based access rights and audit logs.

The company that operates the service and therefore the recipient of the personal data is: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. For data subjects in the EU and EEA, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Microsoft Limited, Microsoft Campus, Thames Valley Park, Reading, RG6 1WG, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Microsoft Schweiz GmbH, Seestrasse 356, 8038 Zurich, Switzerland.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service is a certified member of the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework. You can find more information at dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Purposes for which the personal data are to be processed and the legal basis for the processing: The purpose of the processing is to support employees in the creation of content, to automate workflows, to improve productivity and to increase efficiency in teamwork. The processing is carried out on the basis of Art. 6 (1) (b) GDPR, for the performance of a contract to which the data subject is party and on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in the modern, AI-supported work organization, the quality assurance of results and the relief of routine tasks.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract or necessary for the conclusion of a contract. You are not obliged to provide us or the operating company with personal data. However, if you do not provide personal data, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Microsoft Copilot and Microsoft 365 can be found at https://www.microsoft.com.

48. Data protection provisions about the application and use of Google Login / Sign-In

Sign in with Google, an authentication service provided by Google, is used to enable users to log in or register for our services using an existing Google account. With the user’s consent, Google provides certain account information that is necessary to complete the login process. During use, personal data such as Google ID, name, email address, profile picture, and technical data such as IP address, device and browser information, timestamps, and login events may be processed. This data is necessary to verify the user’s identity, perform the login process securely, and prevent unauthorized access.

The company that operates the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the processing is to implement a secure and simplified registration and authentication procedure, to manage user accounts, and to ensure system security. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in providing a secure, user-friendly authentication procedure and in protecting against unauthorized access.

The company that operates the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the Data Privacy Frameworks. For more information, please visit https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. If you do not provide this data, you will not be able to use Sign in with Google.

Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy.

49. Data protection provisions about the application and use of Facebook Login / Sign-In

Sign in with Facebook, an authentication service provided by Meta, is used to enable users to log in or register for our services using an existing Facebook account. With the user’s consent, Meta transmits certain account information that is necessary to complete the login process. During use, personal data such as Facebook ID, name, email address, profile picture, and technical data such as IP address, device and browser information, timestamps, and login events may be processed. This data is necessary to verify the user’s identity, technically perform the login process, and prevent unauthorized access.

The company that operates the service and thus the recipient of the personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and the EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as the contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent’s Place, London, NW1 3FG, United Kingdom.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the processing is to implement a secure authentication and login procedure, to manage user accounts, and to ensure system security. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in providing a secure and user-friendly login procedure and in protecting against unauthorized access.

The company that operates the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

Further information and Meta’s applicable privacy policy can be found at https://www.facebook.com/privacy/policy/.

50. Data protection provisions about the application and use of LinkedIn Login / Sign-In

Sign in with LinkedIn, an authentication service provided by LinkedIn, is used to enable users to log in or register for our services using an existing LinkedIn account. With the user’s consent, LinkedIn transmits certain account information necessary to complete the login process. During use, personal data such as LinkedIn ID, name, email address, profile information, and technical data such as IP address, device and browser information, timestamps, and login events may be processed. This data is necessary to verify the user’s identity, technically implement the login process, and prevent unauthorized access.

The company that operates the service and thus the recipient of the personal data is: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Purposes for which the personal data is to be processed and the legal basis for processing: The purpose of the processing is to carry out a secure authentication and registration procedure, to manage user accounts, and to ensure system security. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in providing a secure and user-friendly login procedure and in protecting against unauthorized access.

Further information and LinkedIn’s applicable privacy policy can be found at https://www.linkedin.com.

51. Data protection provisions about the application and use of LogMeIn

LogMeIn is used to centrally manage IT systems, perform remote access, and handle technical support and maintenance tasks. The solutions used include functions for remote control of end devices, remote monitoring and management (RMM), support ticket management, device management (MDM), and remote support sessions. Connection and session data, device and system information, user IDs, IP addresses, timestamps, and log data may be processed during use. The processing is necessary to ensure the secure operation of the IT infrastructure, to process support requests, to monitor systems, and to troubleshoot technical issues.

The company that operates the service and thus the recipient of the personal data is: GoTo Technologies USA, LLC, 333 Summer Street, 5th Floor, Boston, MA 02210, USA. For data subjects in the EU and the EEA, GoTo Technologies Ireland Unlimited Company, 77 Sir John Rogerson’s Quay, Block C, Suite 207, Grand Canal Docklands, Dublin 2, D02 VK60, Ireland, acts as the contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: GoTo Technologies UK Limited, 5 New Street Square, London EC4A 3TW, United Kingdom.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the processing is to perform remote access and remote maintenance, provide technical support, manage IT systems, and ensure the functionality and security of remote connections. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the secure, efficient, and controlled execution of remote access and support processes, as well as in the protection of the IT infrastructure.

The company that operates the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. GoTo Group, Inc. may have concluded one of the EU standard contractual clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

Further information and LogMeIn’s applicable privacy policy can be found at https://www.logmein.com/.

52. Data protection provisions about the application and use of FortiMail

FortiMail, an email security service, is used to check incoming and outgoing email communications for security risks and to ensure protection against spam, malware, phishing, and other harmful content. FortiMail analyzes email content and associated metadata to identify suspicious messages and implement appropriate protective measures. During use, personal data such as email addresses, sender and recipient information, subject lines, email content, IP addresses, timestamps, and technical log data may be processed. This data is necessary to ensure the security of email communications, ward off attacks, and ensure the proper functioning of the email infrastructure.

The company that operates the service and thus the recipient of the personal data is: Fortinet, Inc., 899 Kifer Road, Sunnyvale, CA 94086, USA. For data subjects in the EU and the EEA, Fortinet GmbH, Feldbergstr. 35, 60323 Frankfurt am Main, Germany, acts as the contact and representative within the meaning of Art. 27 GDPR.

Purposes for which the personal data is to be processed and the legal basis for processing: The purpose of processing is to secure email communication, detect and defend against malware, spam, and phishing attacks, enforce security policies, and log security-related events. Processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in protecting the IT infrastructure, the confidentiality of communications, and defending against security threats.

Further information and the applicable data protection regulations of Fortinet / FortiMail can be found at https://www.fortinet.com/.

53. Data protection provisions about the application and use of Mailjet

Mailjet, a service provided by Mailjet SAS for sending, receiving, and analyzing email communications, is used to send emails, monitor deliveries, and control sending processes. Mailjet processes data from email transactions as well as technical information for the execution and evaluation of the sending process. During use, personal data such as email addresses, sender and recipient information, subject lines, email content, IP addresses, timestamps, and sending and delivery logs may be processed. This data is necessary to reliably send emails, identify delivery problems, and ensure the functionality of the sending infrastructure.

The operator of the service and thus the recipient of the personal data is: Mailjet SAS, 13–13 bis rue de l’Aubrac, 75012 Paris, France.

Purposes for which the personal data is to be processed and the legal basis for processing: The purpose of the processing is the technical sending and receiving of emails, the monitoring and analysis of sending and delivery processes, error diagnosis, and ensuring stable and secure email operation. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the reliable, efficient, and secure handling of electronic communication.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. If you do not provide this data, emails cannot be sent via Mailjet.

Further information and Mailjet’s applicable data protection provisions can be found at https://www.mailjet.com/.

54. Data protection provisions about the application and use of FortiMail Cloud

FortiMail Cloud, a cloud-based email security service, is used to centrally check incoming and outgoing email communications and protect them from security risks. The service automatically analyzes emails to detect and block spam, malware, phishing attempts, and other malicious content. As part of its use, FortiMail Cloud processes email content and associated metadata. This may involve the processing of personal data such as email addresses, sender and recipient information, subject lines, message content, IP addresses, timestamps, and security-related log data. The processing is necessary to ensure the security of email communications and prevent attacks on the IT infrastructure.

Purposes for which the personal data is to be processed and the legal basis for processing: The purpose of processing is cloud-based backup of email communication, detection and prevention of spam, malware, and phishing attacks, enforcement of security policies, and logging of security-related events. Processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the protection of IT systems, the confidentiality of electronic communications, and the defense against cyber threats.

The company that operates the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. If you do not provide this data, secure email communication via FortiMail Cloud cannot be guaranteed.

Further information and the applicable privacy policy of FortiMail Cloud can be found at https://fortimailcloud.com/.

55. Data protection provisions about the application and use of StackAdapt

StackAdapt, a service for displaying and controlling digital advertising content, is used to technically provide and display online advertising campaigns and to evaluate their reach and interactions. The service processes data relating to the delivery of advertising material, user interactions, and technical access information. During use, personal data such as IP addresses, online identifiers, device and browser information, timestamps, interaction data, and pseudonymized usage profiles may be processed. This data is necessary to deliver advertising content correctly from a technical standpoint, to measure its performance, and to ensure the stability and security of advertising delivery.

The company that operates the service and thus the recipient of the personal data is: StackAdapt, Inc., 200 Bay Street, South Tower, Unit # 2103, Toronto, ON M5J 2J1, Canada.

Purposes for which the personal data is to be processed and the legal basis for processing: The purpose of the processing is the technical implementation, control, and evaluation of digital advertising campaigns, the measurement of reach and interactions, and the optimization of advertising delivery. Processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the efficient technical provision and evaluation of online advertising measures and in ensuring stable and controlled campaign operation.

The company that operates the service and thus the recipient of the personal data is located in a country that has been recognized by the European Commission as a country with an adequate level of data protection. Therefore, no additional safeguards are required for data transfer.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. If you do not provide this data, advertising content may not be displayed or may not be displayed correctly.

Further information and StackAdapt’s applicable data protection regulations can be found at https://www.stackadapt.com/.

56. Data protection provisions about the application and use of The Trade Desk

The Trade Desk, a service for the technical delivery and control of digital advertising content, is used to provide online advertising and to evaluate its delivery and interactions. It is integrated via domains such as adsrvr.org, through which advertising material is technically delivered and measured. As part of its use, The Trade Desk processes data about the delivery of ads, user interactions, and technical access information. This may involve the processing of personal data such as IP addresses, online identifiers, cookie IDs, device and browser information, timestamps, interaction data, and pseudonymized usage profiles. This data is necessary to technically deliver advertising content, measure reach, and ensure the stability and security of ad delivery.

The company that operates the service and thus the recipient of the personal data is: The Trade Desk, Inc., 42 N. Chestnut Street, Ventura, CA 93001, USA.

Purposes for which the personal data is to be processed and the legal basis for processing: The purpose of the processing is the technical implementation, control, and evaluation of digital advertising campaigns, the measurement of reach and interactions, and the assurance of stable and controlled campaign operation. The processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the efficient provision and analysis of online advertising content and the maintenance of a functional advertising infrastructure.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. If you do not provide this data, advertising content may not be displayed or may not be displayed correctly.

Further information and The Trade Desk’s applicable privacy policy can be found at https://www.thetradedesk.com/.

57. Data protection provisions about the application and use of Google Direct Offers

Google Direct Offers, an advertising-based offer format provided by Google within Google Search, is used to display discounted offers or special promotions directly in the search results. The integration takes place within the framework of Google advertising services, where offers are displayed in a context-relevant manner based on search queries. In the course of this use, Google processes data regarding search queries, interaction with the displayed offers, and technical access information. This may involve the processing of personal data such as IP addresses, search terms, device and browser information, location data, timestamps, and interaction data. This data is necessary to display offers correctly, evaluate their use, and ensure the technical functionality of the ad services.

The operator of the service and thus the recipient of the personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as the contact point and representative within the meaning of Art. 27 GDPR. The representative under UK national law is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the technical display of promotional ads within Google Search, the measurement of reach and interactions, and the evaluation of the use of the displayed offers. Processing is carried out on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in the targeted display of offers in the context of relevant search queries and the analysis of the effectiveness of digital advertising formats.

The operator of the service is located in a third country, namely the United States. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate safeguards as specified in Article 46(2) GDPR. The operator of the service may be a certified member of one or more data privacy frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, ads may not be displayed correctly or at all within Google Search.

Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy.

58. Data protection provisions about the application and use of Elfsight

Elfsight, a service for integrating external website widgets, is used to display additional features such as forms, reviews, social media feeds, chat elements, calendars, or similar interactive content on our website. The widgets are integrated into our website via embedded code and loaded from Elfsight’s servers when the respective pages are accessed. In doing so, Elfsight processes data regarding the use of the widgets as well as interactions with the integrated features. This includes, in particular, IP addresses, device and browser information, timestamps, usage data, and content that users actively submit via form or widget functions. This data is necessary to technically provide the widgets, ensure their functionality, and guarantee the stability of the integration.

The operator of the service and thus the recipient of the personal data is: Elfsight, SL, Escaldes-Engordany, C. de la Constitució 17, AD700 Andorra.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the technical provision, display, and use of interactive website features, the processing of user interactions within the widgets, and ensuring the functionality and security of the integrated content. Processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in the functional expansion of our website as well as the user-friendly and stable display of external content.

The operator of the service and thus the recipient of the personal data is based in a country recognized by the European Commission as having an adequate level of data protection. Therefore, no additional safeguards are required for the data transfer.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. However, if you do not provide such data, you may not be able to use our services or those of the operator of the service.

Further information and Elfsight’s applicable privacy policy can be found at https://elfsight.com/.

59. Data protection provisions about the application and use of Google Login / Sign-In

Sign in with Google, an authentication service provided by Google, is used to allow users to log in or register for our services using an existing Google account. Upon the user’s consent, Google provides certain account information necessary to complete the login process. During use, personal data such as the Google ID, name, email address, and profile picture, as well as technical data such as IP address, device and browser information, timestamps, and login events, are processed. This data is necessary to verify the user’s identity, securely complete the login process, and prevent unauthorized access.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is to implement a secure and simplified registration and authentication process, to manage user accounts, and to ensure system security. Processing is based on Art. 6(1)(f) GDPR. The legitimate interest lies in providing a secure, user-friendly authentication process and in protecting against unauthorized access.

The operator of the service is based in a third country, namely the United States. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate safeguards as specified in Article 46(2) GDPR. The operator of the service may be a certified member of one or more data privacy frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor by contract, nor is it necessary to enter into a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide this data, you will not be able to use the “Sign in with Google” feature.

Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy.

60. Data protection provisions about the application and use of Facebook Login / Sign-In

Sign in with Facebook, an authentication service provided by Meta, is used to allow users to log in or register for our services using an existing Facebook account. Upon the user’s consent, Meta transmits certain account information required to complete the login process. During use, personal data such as the Facebook ID, name, email address, and profile picture, as well as technical data such as IP address, device and browser information, timestamps, and login events, are processed. This data is necessary to verify the user’s identity, technically execute the login process, and prevent unauthorized access.

The operator of the service and thus the recipient of the personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and the EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as the contact point and representative within the meaning of Article 27 GDPR. The representative under UK national law is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent’s Place, London, NW1 3FG, United Kingdom.

Purposes for which the personal data will be processed, as well as the legal basis for the processing: The purpose of the processing is to carry out a secure authentication and login procedure, to manage user accounts, and to ensure system security. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in providing a secure and user-friendly login process and in protecting against unauthorized access.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor by contract, nor is it necessary to enter into a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide this data, you will not be able to use the “Sign in with Facebook” feature.

Further information and Meta’s applicable privacy policy can be found at
https://www.facebook.com/privacy/policy/.

61. Data protection provisions about the application and use of LinkedIn Login / Sign-In

Sign in with LinkedIn, an authentication service provided by LinkedIn, is used to allow users to log in or register for our services using an existing LinkedIn account. Upon the user’s consent, LinkedIn transmits certain account information required to complete the login process. During use, personal data such as the LinkedIn ID, name, email address, and profile information, as well as technical data such as IP address, device and browser information, timestamps, and login events, are processed. This data is necessary to verify the user’s identity, technically implement the login process, and prevent unauthorized access.

The operator of the service and thus the recipient of the personal data is: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is to carry out a secure authentication and login procedure, to manage user accounts, and to ensure system security. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in providing a secure and user-friendly login process as well as in protecting against unauthorized access.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, you will not be able to use the “Sign in with LinkedIn” feature.

Further information and LinkedIn’s applicable privacy policy can be found at https://www.linkedin.com/.

62. Data protection provisions about the application and use of LogMeIn

We use LogMeIn to centrally manage IT systems, perform remote access, and technically handle support and maintenance operations. The solutions used include functions for remote control of end devices, remote monitoring and management (RMM), support ticket management, device management (MDM), and conducting remote support sessions. In the course of use, connection and session data, device and system information, user IDs, IP addresses, timestamps, and log data may be processed. This processing is necessary to ensure the secure operation of the IT infrastructure, to handle support requests, to monitor systems, and to resolve technical issues.

The operator of the service and thus the recipient of the personal data is: GoTo Technologies USA, LLC, 333 Summer Street, 5th Floor, Boston, MA 02210, USA. For data subjects in the EU and the EEA, GoTo Technologies Ireland Unlimited Company, 77 Sir John Rogerson’s Quay, Block C, Suite 207, Grand Canal Docklands, Dublin 2, D02 VK60, Ireland, acts as the contact point and representative within the meaning of Art. 27 GDPR. The representative under UK national law is: GoTo Technologies UK Limited, 5 New Street Square, London EC4A 3TW, United Kingdom.

Purposes for which personal data is to be processed, as well as the legal basis for processing: The purpose of processing is to perform remote access and remote maintenance, provide technical support, manage IT systems, and ensure the functionality and security of remote connections. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the secure, efficient, and controlled execution of remote access and support processes, as well as in the protection of the IT infrastructure.

The operator of the service is located in a third country, namely the United States. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate safeguards referred to in Article 46(2) GDPR. GoTo may have concluded one of the EU standard contractual clauses with us. You may request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to , the operator of the service. If you do not provide such data, remote access or support services via LogMeIn cannot be used.

Further information and LogMeIn’s applicable privacy policy can be found at https://www.logmein.com/.

63. Data protection provisions about the application and use of FortiMail

FortiMail, an email security service, is used to scan incoming and outgoing email communications for security risks and to ensure protection against spam, malware, phishing, and other harmful content. In doing so, FortiMail analyzes email content and associated metadata to detect suspicious messages and implement appropriate protective measures. In the course of use, personal data such as email addresses, sender and recipient information, subject lines, email content, IP addresses, timestamps, and technical log data may be processed. This data is necessary to ensure the security of email communication, defend against attacks, and ensure the proper operation of the email infrastructure.

The operator of the service and thus the recipient of the personal data is: Fortinet, Inc., 899 Kifer Road, Sunnyvale, CA 94086, USA. For data subjects in the EU and the EEA, Fortinet GmbH, Feldbergstr. 35, 60323 Frankfurt am Main, Germany, acts as the contact point and representative within the meaning of Art. 27 GDPR.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is to secure email communication, detect and defend against malware, spam, and phishing attacks, enforce security policies, and log security-related events. Processing is carried out on the basis of Article 6(1)(f) GDPR. The legitimate interest lies in the protection of the IT infrastructure, the confidentiality of communications, and the defense against security threats.

The operator of the service is located in a third country, namely the United States. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate safeguards referred to in Article 46(2) GDPR. The operator of the service may be a certified member of one or more data privacy frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law nor by contract, nor is it necessary to enter into a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, secure email communication via FortiMail cannot be guaranteed.

Further information and Fortinet’s applicable privacy policy can be found at https://www.fortinet.com/.

64. Data protection provisions about the application and use of Mailjet

Mailjet, a service provided by Mailjet SAS for sending, receiving, and analyzing email communications, is used to technically send emails, monitor deliveries, and manage sending processes. In doing so, Mailjet processes data from email transactions as well as technical information regarding the execution and evaluation of the sending process. In the course of use, personal data such as email addresses, sender and recipient information, subject lines, email content, IP addresses, timestamps, and sending and delivery logs may be processed. This data is necessary to reliably carry out email delivery, identify delivery issues, and ensure the functionality of the delivery infrastructure.

The operator of the service and thus the recipient of the personal data is: Mailjet SAS, 13 rue de l’Aubrac, 75012 Paris, France.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the technical sending and receiving of emails, the monitoring and analysis of sending and delivery processes, error diagnosis, and ensuring stable and secure email operations. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the reliable, efficient, and secure handling of electronic communications.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide this data, email delivery via Mailjet cannot be carried out.

Further information and Mailjet’s applicable privacy policy can be found at https://www.mailjet.com/.

65. Data protection provisions about the application and use of FortiMail Cloud

FortiMail Cloud, a cloud-based email security service, is used to centrally scan incoming and outgoing email communications and protect them from security risks. The service automatically analyzes emails to detect and block spam, malware, phishing attempts, and other malicious content. As part of its operation, FortiMail Cloud processes email content and associated metadata. In doing so, personal data such as email addresses, sender and recipient information, subject lines, message content, IP addresses, timestamps, and security-related log data may be processed. This processing is necessary to ensure the security of email communication and to prevent attacks on the IT infrastructure.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the cloud-based security of email communication, the detection and prevention of spam, malware, and phishing attacks, the enforcement of security policies, and the logging of security-related events. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the protection of IT systems, the confidentiality of electronic communications, and the defense against cyber threats.

The operator of the service is located in a third country, namely the United States. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate safeguards referred to in Article 46(2) GDPR. The operator of the service may be a certified member of one or more data privacy frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, secure email communication via FortiMail Cloud cannot be guaranteed.

Further information and the applicable FortiMail Cloud privacy policy can be found at https://fortimailcloud.com/.

66. Data protection provisions about the application and use of StackAdapt

StackAdapt, a service for delivering and managing digital advertising content, is used to technically provide and deliver online advertising campaigns and to evaluate their reach as well as interactions. The service processes data regarding the delivery of advertising materials, user interactions, and technical access information. During use, personal data such as IP addresses, online identifiers, device and browser information, timestamps, interaction data, and pseudonymized usage profiles may be processed. This data is necessary to deliver advertising content technically correctly, measure its performance, and ensure the stability and security of ad delivery.

The operator of the service and thus the recipient of the personal data is: StackAdapt Inc., 200 Bay Street, South Tower, Unit 2103, Toronto, ON M5J 2J1, Canada.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the technical implementation, control, and evaluation of digital advertising campaigns, the measurement of reach and interactions, and the optimization of ad delivery. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the efficient technical delivery and evaluation of online advertising measures, as well as ensuring stable and controlled campaign operations.

The operator of the service and, consequently, the recipient of the personal data is located in a country recognized by the European Commission as having an adequate level of data protection. Therefore, no additional safeguards are required for the data transfer.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, advertising content may not be displayed or may not be displayed correctly.

Further information and StackAdapt’s applicable privacy policy can be found at https://www.stackadapt.com/.

67. Data protection provisions about the application and use of Officebureau

Officebureau, a service for providing virtual office and business services, is used to facilitate administrative services such as business addresses, mail handling, document management, and communication services. In the course of its operations, Officebureau processes data necessary to perform these services. This may include personal data such as names, contact information, mail and document content, sender and recipient information, timestamps, and technical usage data. This data is necessary to properly provide the office and administrative services offered at and to ensure organizational processes.

The operator of the service and thus the recipient of the personal data is: Officebureau Inc., 100 King Street West, Suite 5700, Toronto, Ontario M5X 1C7, Canada.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the provision of virtual office and administrative services, the handling and forwarding of business mail, the organization of administrative processes, and the assurance of proper business operations. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the efficient organization of administrative tasks and the use of external office and infrastructure services.

The operator of the service and, therefore, the recipient of the personal data is located in a country recognized by the European Commission as having an adequate level of data protection. Therefore, no additional safeguards are required for the data transfer.

The criteria for determining the period for which personal data is processed are the contractual relationship between us and the operator of the service, or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, Officebureau may not be able to provide its administrative services.

Further information and Officebureau’s applicable privacy policy can be found at https://officebureau.ca/.

68. Data protection provisions about the application and use of The Trade Desk

The Trade Desk, a service for the technical delivery and management of digital advertising content, is used to provide online advertising and to evaluate its delivery and interactions. Integration occurs via domains such as adsrvr.org, through which advertising materials are technically delivered and measured. As part of its use, The Trade Desk processes data regarding ad delivery, user interactions, and technical access information. In doing so, personal data such as IP addresses, online identifiers (e.g., cookie IDs), device and browser information, timestamps, interaction data, and pseudonymized usage profiles may be processed. This data is necessary to technically deliver advertising content, measure reach, and ensure the stability and security of ad delivery.

The operator of the service and thus the recipient of the personal data is: The Trade Desk, Inc., 42 N. Chestnut Street, Ventura, CA 93001, USA.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of the processing is the technical implementation, management, and evaluation of digital advertising campaigns, the measurement of reach and interactions, and the assurance of stable and controlled campaign operations. Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the efficient technical delivery and analysis of online advertising content, as well as the maintenance of a functional advertising infrastructure.

The operator of the service is located in a third country, namely the United States. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate safeguards referred to in Article 46(2) GDPR. The operator of the service may be a certified member of one or more data privacy frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. You may request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operator of the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operator of the service. If you do not provide such data, advertising content may not be displayed or may not be displayed correctly.

Further information and The Trade Desk’s applicable privacy policy can be found at https://www.thetradedesk.com/.

69. APPENDIX 1 to ZINCFIVE PRIVACY POLICY

CALIFORNIA PRIVACY RIGHTS NOTICE

Effective Date: Jan 30, 2026

1. YOUR CALIFORNIA PRIVACY RIGHTS UNDER THE CCPA

Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), if You are a resident of California You have the following rights with respect to Your Personal Information.

1.1 Right to Know About Our Collection, Disclosure, Sharing and Sale of Personal Information about You.

Personal Information as defined in the CCPA is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to You, including the following categories of information: (a) identifiers; (b) categories described in California Civil Code §1798.80(e); (c) characteristics of protected classes; (d) commercial information; (e) biometric information; (f) internet or other electronic network activity; (g) geolocation data; (h) audio, electronic, visual, thermal, olfactory or similar information; (i) professional or employment related information; (j) education information; and (k) inferences drawn from such information to create a consumer profile.

You have the right to know the categories of Personal Information We have collected about You; the categories of sources from which We collect Personal Information; Our business or commercial purpose for collecting, disclosing, sharing, or selling Personal Information; the categories of third parties to whom We disclose, share, or sell Personal Information, if any; and the specific pieces of Personal Information We have collected about You. Personal Information includes “sensitive” Personal Information as described below.

1.2 Right to Know About Our Collection, Disclosure, Sharing and Sale of “Sensitive” Personal Information about You.

“Sensitive” Personal Information as defined in the CCPA is Personal Information that reveals: (a) Your Social Security, driver’s license, state identification card, or passport number; (b) Your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) Your precise geolocation; (d) Your racial or ethnic origin, religious, or philosophical beliefs, or union membership; (e) the contents of Your mail, email, and text messages unless We are the intended recipient of the communication; and (f) Your genetic data. “Sensitive” Personal Information also includes biometric information that is processed for the purpose of identifying You, information that is collected and analyzed concerning Your health; or Your sex life or sexual orientation.

You have the right to know the categories of “sensitive” Personal Information We have collected about You, the categories of sources from which We collect Personal Information, Our business or commercial purpose for collecting, selling, or sharing “sensitive” Personal Information, the categories of third parties with whom We sell or share “sensitive” Personal Information, if any, and the specific pieces of “sensitive” Personal Information We have collected about You.

1.3 Right to Delete Your Personal Information

Subject to the exceptions set out below, and upon Your submission of a verifiable request, You have the right to deletion of Your Personal Information from Our records, and to have Us direct Our Service Providers/Contractors and third parties to delete Your Personal Information from their records.

We are not required to, and reserve Our right to not delete Your Personal Information if it is necessary to: (i) complete the transaction for which the Personal Information was collected, provide a good or service requested by You, or reasonably anticipated within the context of Our ongoing business relationship with You, or otherwise perform a contract between You and Us; (ii) help to ensure security and integrity to the extent the use of Your Personal Information is reasonably necessary and proportionate for those purposes; (iii) debug to identify and repair errors that impair existing intended functionality; (iv) exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law; (v) comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code; (vi) engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when Our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided We have obtained Your informed consent; (vii) enable solely internal uses that are reasonably aligned with Your expectations based on Your relationship with Us and compatible with the context in which You provided the information; and (viii) comply with a legal obligation.

1.4 Right to Correct Inaccurate Personal Information.

Subject to the exceptions set out below, and upon Your submission of a verifiable request, You have the right to correct any inaccurate Personal Information in Our records, and to have Us direct Our Service Providers/Contractors and third parties to correct any inaccurate Personal Information from their records.

If We cannot verify Your identity pursuant to the CCPA and its regulations, We may deny a request to correct. In such event, We shall inform You that Your identity cannot be verified.

In determining the accuracy of the Personal Information that is the subject of Your request to correct, We shall consider the totality of the circumstances relating to the contested Personal Information. We may deny Your request to correct if We determine that the contested Personal Information is more likely than not accurate based on the totality of the circumstances.

1.5 Right to Be Free from Discrimination

You have the right to not be discriminated against by Us because You exercised any of Your rights under the CCPA. This means We cannot, on the basis of the exercise of Your rights thereunder, among other things, deny goods or services to You, charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; provide a different level or quality of goods or services to You; or suggest that You will receive a different price or rate for goods or services or a different level or quality of goods or services or retaliate against You as an employee, applicant for employment, or independent contractor.

1.6 Right to Opt-Out of the Sharing of Personal Information

We may disclose Your Personal Information to third parties for cross-context behavioral advertising purposes (“Share” or “Sharing”). This means the targeting of advertising to You based on Your Personal Information that We obtain from Your activity across businesses, distinctly-branded websites, applications, or services, other than Our business, distinctly-branded website, application, or service. We may Share Personal Information with Advertising Networks so they may help Us to deliver advertisements to You based on Your activity on the ZincFive Website or apps and/or Your activity on other websites or apps.

You have the right to opt-out of the Sharing of Your Personal Information and You may exercise Your right by clicking the following link. If You exercise Your right to opt-out of the Sharing of Your personal information, We will refrain from Sharing Your Personal Information, unless You subsequently provide express authorization for the sharing of Your Personal Information.

1.7 Right to Opt-Out of the Sale of Personal Information

We may disclose Your Personal Information to third parties in exchange for monetary or other consideration. Such disclosures are considered to be “Sales” under the CCPA. We may Sell Personal Information to advertising networks so they may help Us to deliver advertisements to You based on Your activity on the ZincFive Website or any other Company Programs and/or to recommend Our products/services to You based on Your activity on other websites or apps. You have the right to opt-out of the Sale of Your Personal Information and You may exercise Your right by clicking on the following link: Do Not Sell My Personal Information . If You exercise Your right to opt-out of the Sale of Your Personal Information, We will refrain from Selling Your Personal Information, unless You subsequently provide express authorization for the Sale of Your Personal Information.

1.8 Right to Limit the Use of “Sensitive” Personal Information

We use Your “sensitive” Personal Information only to the extent that it is necessary to provide Our products/services as reasonably expected by You. If We were to use Your “sensitive” Personal Information other than is necessary to provide Our products/services, You would have the right to limit Our use of Your “sensitive” Personal Information to that which is necessary to provide Our products/services to You.

1.9 Right of Children to Opt-In to the Sale of Personal Information

We do not knowingly collect or sell the Personal Information of minors under 16 years of age without affirmative authorization. For minors who wish to opt-in to the sale of their Personal Information, We have established the following processes:

Minors between 13 and 16 years of age:

In the case of consumers between 13 and 16 years of age, We require the consumer to affirmatively authorize the sale of the consumer’s Personal Information. In order to opt-in minors in this age range, as part of the account registration process for Our products which may be targeted toward minors, We require the consumer or consumer’s parent or guardian to verify the consumer’s identity by providing at least two data points with data points maintained by the business, which We have determined to be reliable for the purpose of verifying the consumer.

Minors under 13 years of age:

In the case of consumers who are less than 13 years of age, We require the consumer’s parent to affirmatively authorize the sale of the consumer’s personal information. In order to opt-in minors in this age range, as part of the account registration process for Our products/services s which may be targeted toward minors, We require that the consumer’s parent or guardian verify the consumer’s identity, which We have determined to be reliable for the purpose of verifying the consumer.

We reserve the right to require additional information or not complete Your request if We cannot verify Your identity. If You are a parent or guardian seeking to opt-out on behalf of their child, please contact Us at 1-888-735-6891 or email Us at privacy@zincfive.com with the subject “Minor Opt-Out.”

2. HOW TO EXERCISE YOUR CCPA RIGHTS

Unless otherwise specified, to exercise any of Your rights described in this Appendix A, please submit Your request to Us at 1-888-735-6891 or at privacy@zincfive.com with the subject “CCPA Consumer Request.”

In order to verify Your request, We will need You to provide Us with enough information to identify You (e.g., Your full name, address, and customer or matter reference number), proof of Your identity and address (e.g., a copy of Your driver’s license or passport and a recent utility or credit card bill), and a description of what right You wish to exercise along with any information to which Your requests relates. If feasible, We will match the identifying information provided by You with the personal information that We already maintain about You.

You may designate an authorized agent to make a request under the CCPA on Your behalf. In order to fulfill Your request to know or delete submitted by an authorized agent, You must provide the authorized agent written permission to do so, and We may require that You verify Your own identity with Us directly.

We reserve Our right not to grant a consumer request if We cannot verify that the person making the request is the person about whom We have collected information, or someone authorized to act on such person’s behalf. You may only make a request to access or receive copies of Personal Information twice within a 12-month period. Any Personal Information We collect from You to verify Your identity in connection with Your request will be used solely for the purposes of verification.

3. OUR PERSONAL INFORMATION COLLECTION, USE, AND DISCLOSURE PRACTICES

A description of the Personal Information that We collect online and off-line is provided in Section 1 of the main Policy.

The purposes for which We collect and use Personal Information are described in Sections 1, 2, 3 and 5 of the main Policy.

Sources from which We receive Personal Information are described in Section 1 of the main Policy.

Our Personal Information disclosure practices are described in Section 1, 2, 3, and 5 of the main Policy.

Our Personal Information retention practices are described in Section 10 of the main Policy.

3.1 Categories of Personal Information Collected; Sold or Shared for Cross-Context Behavioral Advertising; and Disclosed for a Business Purpose within the past 12 months.

Category of Personal Information.	Collected	“Sold” or Shared in the Past 12 Months?	*Categories of Third Parties to Whom Sold or Shared (as such terms are defined in this Privacy Policy)*	Disclosed for a Business Purpose in Past 12 Months?	*Categories of Third Parties to Whom Disclosed (as such terms are defined in this Privacy Policy)*
Individual Identifiers.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Categories Described in California Consumer Records Act, CA Civil Code §1798.81.5.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Characteristics of protected classifications under California or federal law.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Commercial information.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Biometric information.	No	No	Not Applicable	No	Not Applicable
Internet or other electronic network activity.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Geolocation data.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Audio, electronic, visual, thermal, olfactory, or similar information.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Professional or employment-related information.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Education information.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Inferences drawn from any of the information identified above.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals

3.2 Categories of “Sensitive” Personal Information Collected; Sold or Shared for Cross-Context Behavioral Advertising; and Disclosed for a Business Purpose within the past 12 months.

Category of Sensitive Personal Information.	Collected	Shared or Sold in the Past 12 Months?	Categories of Third Parties to Whom Shared or Sold (as such terms are defined in this Privacy Policy)	Disclosed for a Business Purpose in Past 12 Months?	*Categories of Third Parties to Whom Disclosed (as such terms are defined in this Privacy Policy)*
Social Security, Driver’s License, State ID, or Passport Number.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Account Log-in and Password	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Financial Account, Debit Card, Credit Card Number and account access information.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Precise Geolocation.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Racial or ethnic origin, religious or philosophical beliefs or union membership.	Yes	Yes	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals	Yes. Limited to employee information and only to assist company with fostering diversity in its workforce.	Affiliates; Related Parties; Service Providers/ Contractors (as such term is fully defined in Section 3 of the main Privacy Policy); Government Entities; and Outside Professionals
Contents of email, text messages unless We are intended recipient.	Yes	Yes	Not Applicable	No	Not Applicable
Genetic Data	No	No	Not Applicable	No	Not Applicable
Biometric Information for purpose of identification.	No	No	Not Applicable	No	Not Applicable
Health information collected and analyzed.	No	No	Not Applicable	No	Not Applicable
Sex life or sexual orientation collected and analyzed.	Yes	Yes	Affiliates; Related Parties	No. Information is limited to voluntarily provided information from an employee and used only for assisting company with fostering diversity in its workforce	Affiliates; Related PartiesOTHER CALIFORNIA PRIVACY RIGHTS

4. OTHER CALIFORNIA PRIVACY RIGHTS

4.1 Shine the Light Request.

Individual consumers who reside in California and have provided Us with their Personal Information may request information about Our disclosures of certain categories of Personal Information to third parties for their direct marketing purposes. Such requests must include Your name, street address, city, state, and zip code, and be submitted to Us at one of the following addresses: privacy@zincfive.com with the subject “California Shine The Light Request” or ZincFive, Inc., 20170 SW 112th Ave., Tualatin, Oregon, 97062, USA, Attn: General Counsel. Within thirty (30) days of receiving such a request, We will provide a list of the categories of Personal Information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties. This request may be made no more than once per calendar year. We reserve Our right not to respond to requests submitted to addresses other than the addresses specified in this paragraph.

4.2 Minor’s Right to Remove Posted Content.

If You are a California resident under the age of 18, and a registered User of any website where this Policy is posted, California Business and Professions Code Section 22581 permits You to request and obtain removal of content or information that You have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to privacy@zincfive.com with the subject “Privacy Rights for Minors.” Please be aware that such a request does not ensure complete or comprehensive removal of the content or information You have posted and that there may be circumstances in which the law does not require or allow removal even if requested.